• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1310
  • Last Modified:

displaying username in websphere access log


There is a Websphrere NCSA access log (Common option) which should have the following layout:
host, rfc931, username, date:time, request, statuscode, bytes

I see a real access log file where the username is not displayed and "-" in displayed instead.

How can I enable displaying the username in the access log?
0
pavelmed
Asked:
pavelmed
  • 4
  • 2
1 Solution
 
pavelmedAuthor Commented:
So the actual layout looks like this (exxept there are no commas.  I added them here just to separate the fields in this message.
host, -, -, date:time, request, statuscode, bytes.

I need to analyze the access, so basically I need: username, date:time, request.

date:time and request are present in the actual log file, but I need username as well.

Please assist.
0
 
Gary PattersonVP Technology / Senior Consultant Commented:
Username is only populated in the NCSA log if HTTP Basic User authentication is used.  Since you're getting "-", t probably means that HTTP basic authentication isn't being used.

What WAS version are you using, and what authentication mechanism is in use for this application?

- Gary Patterson
0
 
pavelmedAuthor Commented:
Thank you for your answer.
I am not connected to that server now and I can't check the WAS version, but the authentication is definitely not HTTP basic.  So that's explains the "-" in the log file.

Then the question is: how to get username.
One option would be to enable "combined" mode with cookies which would contain user id.
However I checked a configuration file on that WAS server, and while it has a commented out option (see below), it does not specify cookies.
How should I add cookies to the log?
Is it done just by adding \"%{Cookies}i\" to the LogFormat statement (similar to "Referer")?
Also, if yes, how to refresh WAS settings (after uncommenting the statements, of course)?  
Should the WebSphere be stopped and restarted fro the log file options changes to take effect?
Thank you.

#LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
#CustomLog logs/combined.log combined
0
Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

 
Gary PattersonVP Technology / Senior Consultant Commented:
How to get username:  Depends on the authorization method that is in use.  What authorization method is being used?

Assuming that the username is actually stored in a cookie, then enabling combined logging should get it for you.  

Combined NCSA Log:

http://publib.boulder.ibm.com/tividd/td/ITWSA/ITWSA_info45/en_US/HTML/guide/c-logs.html#ncsa

IBM HTTP Server is based on Apache.  Apache Logformat format strings:

http://httpd.apache.org/docs/2.0/mod/mod_log_config.html

Use \"%{Cookie}i\" (not "cookies")

HTTP Header fields:

http://en.wikipedia.org/wiki/List_of_HTTP_header_fields

Remember to backup your current config before making changes

Then make your changes and restart the IBM HTTP Server to enable the new settings:

http://publib.boulder.ibm.com/infocenter/wasinfo/v6r0/index.jsp

- Gary Patterson
0
 
pavelmedAuthor Commented:
Sorry for the delay - I could not get a chance to login to the WAS to check how the access log would work.
Today I got the connection, and made the changes inserting cookies into the access.log file - the cookies were inserted, but I can't use them because the info in cookies is encrypted because of SSL transaction, and I can't extract the username from there.

Are there any other ways to force WAS access log to log usernames so that they could be extracted from the access.log file?
0
 
WebSphereGoddessCommented:
how are you trying to view the access.log, are you bringing it into ISA workbench and trying to analyze or are you trying to parse the data?  
Are you running windows or unix?
If you can go to your <websphere>/bin directory and run the versionInfo.bat for win and ./versionInfo.sh for unix.  Let me know if you 6.1 or 7.0  so I know the Access Log filter set to suggest.  There are filter sets you can use:
    * What was requested
    * When it was requested
    * Who requested it
    * The method of the request
    * The type of file that your server sent in response to the request
    * The return code, which indicates whether or not the request was successful
    * The size of the data that was sent
I believe your looking for the "WHO" part.
0
 
pavelmedAuthor Commented:
I am closing this question.  I was unable to get the username from the access.log file because it is not passed to it, the log file only has "-" in place of it,  The authentication is done by another program.
I am running UNIX.

I am assigning points to Gary.  Thanks to all who looked into the question.
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 4
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now